CVE-2009-0354

low
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x before 3.0.6 allows remote attackers to bypass the Same Origin Policy, and access the properties of an arbitrary window and conduct cross-site scripting (XSS) attacks, via vectors involving a chrome XBL method and the window.eval function.

References

http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html

http://rhn.redhat.com/errata/RHSA-2009-0256.html

http://secunia.com/advisories/33799

http://secunia.com/advisories/33809

http://secunia.com/advisories/33831

http://secunia.com/advisories/33841

http://secunia.com/advisories/33846

http://secunia.com/advisories/33869

http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm

http://www.mandriva.com/security/advisories?name=MDVSA-2009:044

http://www.mozilla.org/security/announce/2009/mfsa2009-02.html

http://www.securityfocus.com/bid/33598

http://www.securitytracker.com/id?1021664

http://www.ubuntu.com/usn/usn-717-1

http://www.vupen.com/english/advisories/2009/0313

https://bugzilla.mozilla.org/show_bug.cgi?id=468581

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9796

https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00240.html

Details

Source: MITRE

Published: 2009-02-04

Updated: 2017-09-29

Type: CWE-79

Risk Information

CVSS v2

Base Score: 2.6

Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N

Impact Score: 2.9

Exploitability Score: 4.9

Severity: LOW

Tenable Plugins

View all (19 total)

IDNameProductFamilySeverity
67795Oracle Linux 4 / 5 : firefox (ELSA-2009-0256)NessusOracle Linux Local Security Checks
critical
63402GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)NessusGentoo Local Security Checks
critical
60527Scientific Linux Security Update : firefox on SL4.x, SL5.x i386/x86_64NessusScientific Linux Local Security Checks
critical
40169openSUSE Security Update : MozillaFirefox (MozillaFirefox-509)NessusSuSE Local Security Checks
critical
39886openSUSE Security Update : MozillaFirefox (MozillaFirefox-509)NessusSuSE Local Security Checks
critical
37673Mandriva Linux Security Advisory : firefox (MDVSA-2009:044)NessusMandriva Local Security Checks
critical
37378Fedora 10 : Miro-1.2.8-2.fc10 / blam-1.8.5-6.fc10 / devhelp-0.22-3.fc10 / epiphany-2.24.3-2.fc10 / etc (2009-1398)NessusFedora Local Security Checks
critical
37217Ubuntu 8.04 LTS / 8.10 : firefox-3.0, xulrunner-1.9 vulnerabilities (USN-717-1)NessusUbuntu Local Security Checks
critical
4965SeaMonkey < 1.1.15 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
medium
4964Mozilla Thunderbird < 2.0.0.21 Multiple VulnerabilitiesNessus Network MonitorSMTP Clients
medium
35640FreeBSD : firefox -- multiple vulnerabilities (8b491182-f842-11dd-94d9-0030843d3802)NessusFreeBSD Local Security Checks
critical
35604Fedora 9 : Miro-1.2.7-4.fc9 / blam-1.8.5-5.fc9.1 / cairo-dock-1.6.3.1-1.fc9.3 / chmsee-1.0.1-8.fc9 / etc (2009-1399)NessusFedora Local Security Checks
critical
35590CentOS 4 / 5 : firefox (CESA-2009:0256)NessusCentOS Local Security Checks
critical
4922Mozilla Firefox 3.x < 3.0.6 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
medium
35585RHEL 4 / 5 : firefox (RHSA-2009:0256)NessusRed Hat Local Security Checks
critical
35581Firefox 3.0.x < 3.0.6 Multiple VulnerabilitiesNessusWindows
high
801212Mozilla Thunderbird < 2.0.0.21 Multiple VulnerabilitiesLog Correlation EngineSMTP Clients
high
800869SeaMonkey < 1.1.15 Multiple VulnerabilitiesLog Correlation EngineWeb Clients
high
800752Firefox < 3.0.6 Multiple VulnerabilitiesLog Correlation EngineWeb Clients
high